44 lines
1.1 KiB
Python
Executable File
44 lines
1.1 KiB
Python
Executable File
#!python3
|
|
from pwn import *
|
|
from sage.all import Integer
|
|
from string import ascii_lowercase, ascii_uppercase, digits
|
|
|
|
conn = remote("mercury.picoctf.net", 4484)
|
|
|
|
conn.recvuntil(b": ")
|
|
flag = conn.recvline().strip()
|
|
conn.recvuntil(b"n: ")
|
|
n = Integer(conn.recvline())
|
|
conn.recvuntil(b"e: ")
|
|
e = Integer(conn.recvline())
|
|
|
|
def remote_encrypt(msg):
|
|
conn.recvuntil(b"me: ")
|
|
conn.sendline(msg)
|
|
conn.recvuntil(b"go: ")
|
|
return conn.recvline().strip()
|
|
|
|
#'''
|
|
charset = ascii_lowercase + digits + "_" + ascii_uppercase + "{}"
|
|
C_residue = flag
|
|
msg = b""
|
|
known_encs = []
|
|
P = log.progress("bruteforcing message")
|
|
while len(C_residue) > 0:
|
|
P.status(msg.decode())
|
|
for new_char in charset:
|
|
new_char = new_char.encode()
|
|
new_msg = msg + new_char
|
|
new_enc = remote_encrypt(new_msg)
|
|
for enc in known_encs:
|
|
new_enc = new_enc.replace(enc, b"")
|
|
if new_enc in C_residue:
|
|
msg += new_char
|
|
known_encs.append(new_enc)
|
|
C_residue = C_residue.replace(new_enc, b"")
|
|
break
|
|
P.success(msg.decode())
|
|
log.info("message: {}".format(msg))
|
|
#'''
|
|
|